Source: XmztmwSit3.elf |
ReversingLabs: Detection: 36% |
Source: XmztmwSit3.elf |
Virustotal: Detection: 37% |
Perma Link |
Source: global traffic |
TCP traffic: 185.196.8.213 ports 59432,2,3,4,5,9 |
Source: global traffic |
TCP traffic: 192.168.2.23:50592 -> 185.196.8.213:59432 |
Source: /tmp/XmztmwSit3.elf (PID: 6255) |
Socket: 127.0.0.1::46157 |
Jump to behavior |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 34.249.145.219 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 34.249.145.219 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 34.249.145.219 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 34.249.145.219 |
Source: unknown |
DNS traffic detected: queries for: jhbaghjbasdg.shop |
Source: unknown |
Network traffic detected: HTTP traffic on port 39268 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 39268 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: classification engine |
Classification label: mal52.troj.linELF@0/1@2/0 |
Source: /usr/bin/dash (PID: 6318) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.rLIS1Axjqg /tmp/tmp.kl74NVvZwE /tmp/tmp.GmcWMqmMNl |
Jump to behavior |
Source: /usr/bin/dash (PID: 6319) |
Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.rLIS1Axjqg /tmp/tmp.kl74NVvZwE /tmp/tmp.GmcWMqmMNl |
Jump to behavior |
Source: /tmp/XmztmwSit3.elf (PID: 6255) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: XmztmwSit3.elf, 6255.1.00007ffc0c8ca000.00007ffc0c8eb000.rw-.sdmp, XmztmwSit3.elf, 6259.1.00007ffc0c8ca000.00007ffc0c8eb000.rw-.sdmp |
Binary or memory string: ;wx86_64/usr/bin/qemu-sparc/tmp/XmztmwSit3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XmztmwSit3.elf |
Source: XmztmwSit3.elf, 6255.1.000055ac6d9e4000.000055ac6da69000.rw-.sdmp, XmztmwSit3.elf, 6259.1.000055ac6d9e4000.000055ac6da49000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/sparc |
Source: XmztmwSit3.elf, 6255.1.000055ac6d9e4000.000055ac6da69000.rw-.sdmp, XmztmwSit3.elf, 6259.1.000055ac6d9e4000.000055ac6da49000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/sparc |
Source: XmztmwSit3.elf, 6255.1.00007ffc0c8ca000.00007ffc0c8eb000.rw-.sdmp, XmztmwSit3.elf, 6259.1.00007ffc0c8ca000.00007ffc0c8eb000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-sparc |